[release/8.0-staging] Backport Replace test certificate chain that uses RSA+SHA-1 #121670
+339
−210
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones |
Copilot finished reviewing on behalf of
vcsjones
November 15, 2025 21:03
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR backports a change to replace test certificate chain data that uses RSA+SHA-1 with a newer RSA+SHA-256 certificate chain for the microsoft.com SSL certificate used in cryptography tests.
- Updates certificate test data from an older certificate chain (microsoft.com → Microsoft RSA TLS CA 01 → Baltimore CyberTrust Root) to a newer chain (microsoft.com → Microsoft Azure RSA TLS Issuing CA 08 → DigiCert Global Root G2)
- Updates all verification times from 2021 dates to 2025 dates to match the new certificate's validity period (2025-10-01 to 2026-03-30)
- Adjusts test expectations for hostname matching, chain element counts, and authority key identifiers to reflect the new certificate chain structure
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/libraries/System.Security.Cryptography/tests/X509Certificates/TestData.cs | Replaces the hex-encoded certificate data for MicrosoftDotComSslCertBytes, MicrosoftDotComIssuerBytes, and MicrosoftDotComRootBytes with new certificates using SHA-256 instead of SHA-1 |
| src/libraries/System.Security.Cryptography/tests/X509Certificates/ChainTests.cs | Updates verification times to 2025 dates, adjusts platform-specific expectations for chain element counts, removes SHA-1 signature support checks, and improves error messages for better debugging |
| src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs | Updates verification times in collection-related tests to match the new certificate validity period |
| src/libraries/System.Security.Cryptography/tests/X509Certificates/MatchesHostnameTests.cs | Updates hostname test cases to match the Subject Alternative Names in the new certificate (e.g., replacing www.microsoft.com with www.microsoft.com.au, adding copilot.ai domains) |
| src/libraries/System.Security.Cryptography/tests/X509Certificates/ExtensionsTests/AuthorityKeyIdentifierTests.cs | Updates expected hex values for authority key identifier tests to match the new certificate issuer (DigiCert Global Root G2 instead of Baltimore CyberTrust Root) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport of #121450 to release/8.0-staging
cc @bartonjs
Customer Impact
These are test only changes. These changes react to more environments in CI rejecting certificate chains that use an RSA+SHA-1 root certificate.
Regression
Testing
Tests that were failing are now passing in CI.
Risk
None, test only changes.